killmbr | 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Geometry dash auto speedhack.bat
Size 13KB
Sample260816-s71slsec75
SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
MD5 4e2a7f369378a76d1df4d8c448f712af
SHA1 1192b4d01254a8704e6d6ae17dc2ec28a7ad5a49
SHA512 90e6eedca424e2ee37c78e0c0380db490c049b0378541812734c134510c40c6e4c48c4e213f395339ed99ff337ef087b6056ac5aafb246c1789ca6082dcabd2e
SSDEEP 192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3
TLSH
T1BB528D3236754E13193326CB5C3AA256BCF4503F761A6E71A4138DFB90AAFD1319EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit discovery execution killmbr persistence ransomware trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c544-190.dat	family_killmbr

Executes dropped EXE 7 IoCs

pid	Process
2244	MEMZ.exe
2972	MEMZ.exe
5640	MEMZ.exe
1232	MEMZ.exe
4756	MEMZ.exe
5932	MEMZ.exe
2748	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_395004631\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4252	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5648	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313688793537898"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{0C80069E-9B60-4013-ABD8-1C6A58CB4C96}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2972	MEMZ.exe
2972	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
2972	MEMZ.exe
1232	MEMZ.exe
2972	MEMZ.exe
1232	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
2972	MEMZ.exe
2972	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
1232	MEMZ.exe
1232	MEMZ.exe
4756	MEMZ.exe
4756	MEMZ.exe
2972	MEMZ.exe
2972	MEMZ.exe
4756	MEMZ.exe
4756	MEMZ.exe
1232	MEMZ.exe
1232	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
2972	MEMZ.exe
2972	MEMZ.exe
4756	MEMZ.exe
4756	MEMZ.exe
5932	MEMZ.exe
5932	MEMZ.exe
2972	MEMZ.exe
2972	MEMZ.exe
5932	MEMZ.exe
5932	MEMZ.exe
4756	MEMZ.exe
4756	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe
1232	MEMZ.exe
1232	MEMZ.exe
2972	MEMZ.exe
2972	MEMZ.exe
5932	MEMZ.exe
5932	MEMZ.exe
5640	MEMZ.exe
4756	MEMZ.exe
4756	MEMZ.exe
5640	MEMZ.exe
2972	MEMZ.exe
2972	MEMZ.exe
4756	MEMZ.exe
4756	MEMZ.exe
5640	MEMZ.exe
5932	MEMZ.exe
5640	MEMZ.exe
5932	MEMZ.exe
1232	MEMZ.exe
1232	MEMZ.exe
2972	MEMZ.exe
2972	MEMZ.exe
5640	MEMZ.exe
5640	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3900	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3900	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1096	cscript.exe
3820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 1096	4252	cmd.exe	90
PID 4252 wrote to memory of 2244	4252	cmd.exe	91
PID 2244 wrote to memory of 2972	2244	MEMZ.exe	93
PID 2244 wrote to memory of 5640	2244	MEMZ.exe	94
PID 2244 wrote to memory of 1232	2244	MEMZ.exe	95
PID 2244 wrote to memory of 4756	2244	MEMZ.exe	96
PID 2244 wrote to memory of 5932	2244	MEMZ.exe	97
PID 2244 wrote to memory of 2748	2244	MEMZ.exe	98
PID 2748 wrote to memory of 1556	2748	MEMZ.exe	99
PID 2748 wrote to memory of 3820	2748	MEMZ.exe	101
PID 3820 wrote to memory of 4532	3820	msedge.exe	102
PID 3820 wrote to memory of 4580	3820	msedge.exe	103
PID 3820 wrote to memory of 5648	3820	msedge.exe	104
PID 3820 wrote to memory of 4580	3820	msedge.exe	103
PID 3820 wrote to memory of 4580	3820	msedge.exe	103
PID 3820 wrote to memory of 4144	3820	msedge.exe	105
PID 3820 wrote to memory of 4144	3820	msedge.exe	105
PID 3820 wrote to memory of 3420	3820	msedge.exe	107
PID 3820 wrote to memory of 2124	3820	msedge.exe	108
PID 3820 wrote to memory of 3420	3820	msedge.exe	107
PID 3820 wrote to memory of 3420	3820	msedge.exe	107
PID 3820 wrote to memory of 2124	3820	msedge.exe	108
PID 3820 wrote to memory of 2124	3820	msedge.exe	108
PID 3820 wrote to memory of 5508	3820	msedge.exe	109
PID 3820 wrote to memory of 4508	3820	msedge.exe	110
PID 3820 wrote to memory of 5508	3820	msedge.exe	109
PID 3820 wrote to memory of 5508	3820	msedge.exe	109
PID 3820 wrote to memory of 4508	3820	msedge.exe	110
PID 3820 wrote to memory of 4508	3820	msedge.exe	110
PID 3820 wrote to memory of 1800	3820	msedge.exe	112
PID 3820 wrote to memory of 1800	3820	msedge.exe	112
PID 3820 wrote to memory of 6140	3820	msedge.exe	113
PID 3820 wrote to memory of 6140	3820	msedge.exe	113
PID 3820 wrote to memory of 6140	3820	msedge.exe	113
PID 3820 wrote to memory of 4332	3820	msedge.exe	115
PID 3820 wrote to memory of 3868	3820	msedge.exe	116
PID 3820 wrote to memory of 4332	3820	msedge.exe	115
PID 3820 wrote to memory of 3868	3820	msedge.exe	116
PID 3820 wrote to memory of 3368	3820	msedge.exe	117
PID 3820 wrote to memory of 3368	3820	msedge.exe	117
PID 3820 wrote to memory of 3368	3820	msedge.exe	117
PID 3820 wrote to memory of 1980	3820	msedge.exe	119
PID 3820 wrote to memory of 244	3820	msedge.exe	121
PID 3820 wrote to memory of 244	3820	msedge.exe	121
PID 3820 wrote to memory of 916	3820	msedge.exe	123
PID 3820 wrote to memory of 916	3820	msedge.exe	123
PID 2748 wrote to memory of 1596	2748	MEMZ.exe	125
PID 3820 wrote to memory of 3336	3820	msedge.exe	126
PID 3820 wrote to memory of 3336	3820	msedge.exe	126
PID 3820 wrote to memory of 3336	3820	msedge.exe	126
PID 3820 wrote to memory of 2644	3820	msedge.exe	127
PID 3820 wrote to memory of 2644	3820	msedge.exe	127
PID 3820 wrote to memory of 2644	3820	msedge.exe	127
PID 3820 wrote to memory of 2260	3820	msedge.exe	128
PID 3820 wrote to memory of 1388	3820	msedge.exe	129
PID 3820 wrote to memory of 5772	3820	msedge.exe	130
PID 2748 wrote to memory of 4584	2748	MEMZ.exe	131
PID 3820 wrote to memory of 6128	3820	msedge.exe	132
PID 3820 wrote to memory of 6128	3820	msedge.exe	132
PID 3820 wrote to memory of 6128	3820	msedge.exe	132
PID 3820 wrote to memory of 5000	3820	msedge.exe	133
PID 3820 wrote to memory of 5000	3820	msedge.exe	133
PID 3820 wrote to memory of 5000	3820	msedge.exe	133
PID 3820 wrote to memory of 240	3820	msedge.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Geometry dash auto speedhack.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:1096
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2972
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5640
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1232
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4756
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5932
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff88ff2c188,0x7ff88ff2c194,0x7ff88ff2c1a0
        5⤵
        
        PID:4532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,8439829164739306575,2299198839814896806,262144 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
        5⤵
        
        PID:4580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,1326056415388251963,4898770730129082954,524288 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,7014736046521617506,11829461029687468553,524288 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:13
        5⤵
        
        PID:4144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,8842386975956622681,14507731944728247461,2097152 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
        5⤵
        
        PID:3420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,16728817783578199506,5120189168557477765,2097152 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
        5⤵
        
        PID:2124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,1361212215717369369,9633765878585714212,2097152 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
        5⤵
        
        PID:5508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,10894948048113320190,4542675024651163892,2097152 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:9
        5⤵
        
        PID:4508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,11210922825624980660,7286269065902810005,524288 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
        5⤵
        
        PID:1800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5392,i,12040610316963932637,13166114469466455949,2097152 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
        5⤵
        
        PID:6140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,10377702892392890701,9296520499308139913,524288 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
        5⤵
        
        PID:4332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,8065161479711606173,18083067710937442213,524288 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
        5⤵
        
        PID:3868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5792,i,10246976929350565517,6401532590474605696,2097152 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
        5⤵
        
        PID:3368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,1622765111875567355,14923983581412127994,524288 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
        5⤵
        
        PID:2812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,1622765111875567355,14923983581412127994,524288 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
        5⤵
        
        PID:1980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,9596242603542470481,12040526831783488280,524288 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
        5⤵
        
        PID:244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,5809743386759884354,16247745744423272274,524288 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
        5⤵
        
        PID:916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4444,i,4644500848303426231,12793718897125995739,2097152 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
        5⤵
        
        PID:3336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5208,i,14035932123168200984,11100304903534748682,2097152 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
        5⤵
        
        PID:2644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,2718277802297184737,10908770263464473282,524288 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
        5⤵
        
        PID:2260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,8266000491990632452,15160091909008366031,524288 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
        5⤵
        
        PID:1388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,17913164651033567164,15031214481918708373,524288 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
        5⤵
        
        PID:5772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5540,i,158950753771296074,8387336311452930260,2097152 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:1
        5⤵
        
        PID:6128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6728,i,9675434551942600099,7767415974703056514,2097152 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
        5⤵
        
        PID:5000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,14356219984414027726,1829210919660189221,524288 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
        5⤵
        
        PID:240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=932,i,13283670915228463257,16115506380775492351,2097152 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
        5⤵
        
        PID:4456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3840,i,12454285521837475649,2671180449920916762,2097152 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
        5⤵
        
        PID:3536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,5588364244258169790,4469803271175105513,524288 --field-trial-handle=2252,i,15246907360292163099,13869612108328895789,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
        5⤵
        
        PID:3460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real
      4⤵
      PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection
      4⤵
      PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:252

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 86KB
SHA256 75ebd0ba936007f8355463df2b47bcbacedcc0818fb7ebec5df08d3be383de9e
MD5 6d8cf9d0c1335132793c16840011687c
SHA1 db51f052cfc80f1204cdb761dbbdf94467597777
SHA512 3a5dc86c128a393bd83762409454b798acb6c6986d0ea92afa4898075497b63380db4f86c5fb2725e81ddee46c9a704fe6461d80dc64fb251ef852db34f0adc0
SSDEEP 1536:vAZjaMkLxmshBbzebVFBs1YUIba+etCnSGPXF:q6HbzebeKUga+etqSkXF
TLSH
T1658312E322B8A816815FC04E2D1550A507752FCFF9FB8C50F71AE6AE12C5672EC0B16B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 157041d5a53b9ed850d5449c4ac3384bbbeb8b6f7406b8fffbcb630b2a809caf
MD5 d8e00a86e5b72011d8cf17c67e92ef94
SHA1 34034bd806ae654c2a4fc436cadb525e303a8cfe
SHA512 cddbed444053532b95581675d1900a8ace09f7d9d69c2b958ef090198362370e53bb4f0290b78fc78fa5a238d1daa92123bf5b8cc4ab9f33553d7f8587851322
TLSH
T134511E234332C9F1D769C4BAD0D3594632F8B8D946076E315C005EB06D26F25F5EC257
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 09a000291819a6557dd358f34ebc5c2a113036427f322cd6f7d9c2744c0f4568
MD5 f004c51af7c2ca519fb83b4f9f1c4ee5
SHA1 1d30dae5e2287922c5e5782fa021824136ba76e3
SHA512 270a96e05369a56a3bb842247879660ea5fc7df78d8b80cbbb56337c3675b11b367f33868efb66108cc0c0ca016357139bc94597b247ffdaef6f30db0943c0ab
TLSH
T1C4512F234332C5F1D769C8BAD0E3994632F8B4D946076E315C005DB06D66F25F5EC2A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5881.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a5881.TMP
Size 2KB
SHA256 862a95b8789fe93482ca27af8f00ac156b114d138af712efd43a008a268a0ff4
MD5 b1ad54ce634c098ac42c25faee08ce6a
SHA1 07b73915c05f81010ad4b2803c57f1976dee4ab4
SHA512 cd7e9941e7bcd1bad7d97f3d3d38d7b6ae1b2b3c163d58140cd2b2376f8d1da34c408b7a9b9e4781b3f11dc730e3f9f9bed3fcd803a74b970ec542e484f9ad2e
TLSH
T1AD511D234336C9F1D769C8BAE0E25A4A32F8B8D946076E314C405EB06D26F25F5EC263
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 30e29bd7ad03c38de5f91d4ca7ab9897cea6acae188e31500d00fa8d68d0dc82
MD5 6fa0055e88e95e36f40d28d5d3d11f78
SHA1 f5ce4b141dea6be5655c50b7e8709a265b4bf641
SHA512 089a6be89705756a865b3ed404ed6d71e74b56fc75d6a204351058f3d1dc7d392764548f60cfe7f4b809b26dd67e2ba26c44fb44876df08d5dfc340fa0b88587
SSDEEP 96:D6O0vVg5dey9IVaZ3zCWWcjXFDw0Wejhuikq:Dp0v65dey9IVaZ3WWWcjXFDdWejhuikq
TLSH
T113C19BF7C7E8852ECC5256F49B257B1FCE2D0928421C3D1AC8D5AE1B93E2871E11564F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b37acd82c070bbbed9edbe7821ca084c73c611f1f4a3228744a532cdc173ea62
MD5 e39d05a9acdd3cc4f72e273f504589d3
SHA1 629f2487873ae68f4d0162a3eea2057c547cdb38
SHA512 c619cdee9e2b82b433d71317f8c62b7476e5be716d634b42c822cac670bdb4d3d6d75482121fa91f3bfa68f729bd4913d395d9bd3c53783c0ff3e17f7f3e990e
SSDEEP 192:sxRPRKC6/fzs0oGKotZSIzoD8pE/F//g6+WNFfIn/Y372LoGWIgVLJ:sxRPX6/fzs0JKoDDu/56/QnD
TLSH
T13042C9166D24A97B9CC7E219BA55BF53D3FD6172A0D41E48ABFC8A1C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 764c1ba966e2a46e585951078477f7ff099f19fac665dc84632912dae30e9e0c
MD5 d65ef23a060bff931c8051d073b0577b
SHA1 41d88a60e97b709baf35ee0c7e5191df5b6f80b3
SHA512 20238909148e55f2fd90d89435fb4bc93cf9c404f53bb1936ea9a60b8e26395095717843a136be76018dd134b5b9e7079be54fabf2f38d06f92c616d54eafe83
SSDEEP 192:sxR8RKC6/fzs/oGKotZSIzoD8pE/F//g6+WNFfIn/Y372LoGWIgDLLJ:sxR8X6/fzs/JKoDDu/56/QnN
TLSH
T1F342CA166D24A97B9CC7E21DBA55BF53D3FD6172A0D41E48ABFC8A1C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 484179324b61743a0da3935cd81c233f1853acb90f9c88808962ccfbef0551d9
MD5 bd5941832296c95c7483b94108d00ccb
SHA1 277e09c3209bae7c746bb2b97635608b62141618
SHA512 39ee7f18c7bf1c247f7ada8d912fc7239b1100a2c326d2351a66bb8b9b93ca35221f3131cc7d101491806baaaeeaf4a208494193427c5c3bf42f66ede73c9dd0
SSDEEP 192:sxR8RKC6/fzs/oGsotZTIzoD8pE7///g6+WNFfUrfYMpbe8boGWIgDZLJ:sxR8X6/fzs/JsoDk0/5afhaD
TLSH
T1AD42C9166D2569779CC7E219BA55BF53E7FD6072A0D01E48EBFC8A1C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ce8938762f1457a471b4908d49380dde91bc9205da946e6ac68a5a8346024ca9
MD5 07beb23cc420cdd74d3882031d5d3410
SHA1 56836e613ccf0e78effd7aa3147ebe778413dab0
SHA512 765d109c4d9a50c30d1bf9e284d730106873a1215b1eb9569891d44996e0097e003950d6acaae339cc198b4d9b029b6ff47dfbb00486e7efd8cfdd51fc9066b2
SSDEEP 768:GTEbEo7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVasgMWcDroJbi+:GTEbEUE7lkWg0CfKsu1jaNsgFcwJW+
TLSH
T10FD2DA7B740DCB7E4F804A9DAC1ABA9B6D6802CB9698CD4047FE941C02C6BFA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 436841de89f186cb7f703cf47b00088d45c8aea75750f82874130b29f02640ff
MD5 de06f09531ab898352f373bbd93f3d68
SHA1 c9984df0e0909796036cf4aac70ac869c4906fb2
SHA512 21da14de872aea51974d6a814ea5d789b000e9e3b83bf04a2e1ffc10592942db183e8a524c4b0ef4e2c943c39bb5ebf250cbc9a2e273131baf349b352951b1c1
TLSH
T1FCB002E9E7415527D41653F9D4EF03497732CC711643930798E739969570380AD61414
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 98fdad9e6e249737181f6da3daddc105982b8c65da5062419623732dca5ee28b
MD5 374afcf7a66efe8c50d65aaa064d93f1
SHA1 292643c06def6eb360e6d86892200ce12a2bf791
SHA512 82ccb004451ca7e4c5d6b9ac16ac42f87a5271cf34bb7c60c59a4523d89cd2fa9e08b979a5344fe9190bc8de3388f7e6ccd5d308edc46bbc86b1c8f59e9790e9
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHYp8IamqwWuzjgwwK4lgSwcgwDyYd6kQK/:C1i7PF/DWrwfX9mgpct1o7zsHYp8Iamk
TLSH
T17C915541347A52903D7E790C81EE8D1BD28374B37209E42B7BAA45965F6AF038DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5af406.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5af406.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3dc3dd743c2de06b2d096677508053d4fc0d652f6847ca91ec22b2da71212dac
MD5 da888aa7e9253f6c3b720195b07a5207
SHA1 499b8f30e3fe1fbdb3f7ac0d286d0fcec61d53da
SHA512 f29942c2666c53f250c69d5b63c5d442a84480e53127135192dfc27ef756f38adb71b10cec30caeb148060dd31cee693f57de9f5252831626538490bde6f3f05
SSDEEP 768:Rrv+4UNbd434akc+wfZOnfOiavShCQtc2bwWV:RbsbO34vwfQfpavS40wO
TLSH
T1BB03CF32E96899339DE692487646BBA3BEB86173C8C54744DACD4B0D018269F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 52ef93ec696a86d85820b25ef1bc3ac66c126ce3156e218b6088871b2c69d60c
MD5 fbc5a6d52011897671c1b0da59a5963b
SHA1 3b89ccc0bbb53ee1097686b67c38f3f11b547ace
SHA512 36e5533e118857f394d7cc19d5d90bd85f3b5a7b9017336bc66dfe109740888d96e0916b04d7ec980503252fbf8b93a6d2f23595a532be7736a25fa217a11698
SSDEEP 768:hrv+4UNbd43g8c+wfZOnfOidfOkvShCQRcPi9Pf:hbsbO3lwfQfpdfVvSwPQ
TLSH
T1C113BF71E97869739DF2D788B64A7B13BFA86163D4C50654DAD88F0C02C369E130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 029dc432b64785c1f21f97192a4739154b0468d85217a10c3eac3006fb9c4178
MD5 2970f379ee5e3399bb224863867d5d6d
SHA1 8b6901ca604e60537cb929c42bc976c916189964
SHA512 1833a73d2d3591d1729a1eea0db18d4cfe07b3737ebc6fb4fdec96efe227da60a5e23d44a6a8a6687b578453a39098fb24adf3245d2295e9d00753549db34410
SSDEEP 384:n/ZcIv38NUunFuUXcHGfd+UJfRXOVyS5dfeXidfeX5g9vShCiDBTayppFJlmqJr2:Xv3W8c+wfZOnfOidfOIvShCQRcPi9PW
TLSH
T110F2AE70E97569639DF6DB89A7496B13FFE86123E5C41648DADC8E0C01C366E130B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a33cba9ed33118d01ede0a22a345edbcd1e56da6f147aca2fc56590ca05df1a5
MD5 06b4163bec720fdfb945640f4f82438d
SHA1 2a1b67c351b870ea29c74b4be6df92ce841f79fc
SHA512 cea339e67b04fe5736924d985f9afe7ca82190d1b1810f60eab4b1c44494cbecbe83abe1e4c9c8f0dc6e5d652dfd9ce00436ae78c1f9df390e91c51acfe6d40f
SSDEEP 384:nHZcIv38NUfnFu5Y2cHGfd+UJfRXOVyS5dfeXidfeX5g9vShCiDBTayppFJlmqJC:vv36YXc+wfZOnfOidfOIvShCQRcPi9PW
TLSH
T11DF2AE70E87569639DF6E789B7496B13FEE86123D5C45648DADC8E0C01C366E130B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 91ad72b29ddd036e1e0ee3563120ff7a6616e49849bc4b453589459e9468c8a8
MD5 9880b36e648201c92dc8cac27492d3a6
SHA1 55197cf598201120f03cd5e0f0a1caed9984c9eb
SHA512 b6b45dbdb8343e82d7c036e71c2edc6bcfb6c1933930cfccf85aaa174b1a6cedb2f68c8f9b909b9242a698331ffe25e6ba01440a38d44fef9e8665784d870056
SSDEEP 768:LFQa3/wgF8AtfZOnfOidfOCvShCQRcPi9PW:ea3JfQfpdftvSwPJ
TLSH
T19D038E75D8B4EA67ADF29BC5B7497703EEE55163C5C899C8DAD88E0C01C369E030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b65e5f49533d93b997ed55be62e86b55a81083927334ef30e31d9de4f6643a6b
MD5 7fb5e96b487a567c0252c42349298730
SHA1 d1df1591b0196c59cb303a96544c874da12f8602
SHA512 e26ff87fd73816a17839a8319b0c4ccff91129ed1a2ea1eac666f9a73563b35fd7b059e5772bb706dd2a5cbb5cfacc6e8726c91f9ced4fd52b85ec240aa03405
SSDEEP 768:jrv+4UNbd43nGc+wfZOnfOidfOgvShCQsc2bwWV:jbsbO30wfQfpdfrvSH0wO
TLSH
T1BA03BF32E97869739EF39648B60ABB53BFA8616384C50744DAC84F0D018369F231BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1fc12d1f87ad739854f8edc27c18f1a9181d9717aa999d3d00dc8031ff2b4162
MD5 4564f297fb8721dfec70cca6af612976
SHA1 41371e2c59cc65543280288f9cb40bbe83ba0e21
SHA512 1d57461c3ab58c9b3d6211878b4d62a7fb4747704ab627afc902270e39c05f1d61eebfd850db448f1b1f649cc07715f1efd2525acd9c1a2779927b66ed70a51b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 63d4cb3ff4486b5127ed4d622399ebc1b16d02cd54ea27d61e6c0a2c23abc449
MD5 1369124029061d56f2d6259a8f39d606
SHA1 502053b2107ead33cc7f7985777ab7bff5f0cd5f
SHA512 86a2e88c5c5ccfaac55792b7ea01a854ad562b8ef493674b2a62fb748f4a6ef4453fb6139d524b23cbdd0df1c0c77a88d33c7adc32b4b6e29c89f2b06c8843b4
TLSH
T12EE00157531410C7C004033000831B513BE7D034273343469E2101681C273012C01301
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5ae570.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5ae570.TMP
Size 392B
SHA256 8531172a2b9a0ed17803f293048816b09ef31844c83f419f5d0b5020c8209914
MD5 e0875ab39ae83536eaabd96079aa4d63
SHA1 9f3aa480b73bd804140388e3a41b78322bee1b22
SHA512 cebd3a5de7f6e1e66584e195d24f2c5b4b98d051059e5292f91f184633d26198c77690344003326a6bdadf0517fa08772ad02eec81bb601544b09a34161671cc
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3820_409221315\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 11KB
SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
MD5 1882f3dd051e401349f1af58d55b0a37
SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
TLSH
T12632BF3332B50E131E1037EA9D1BA21B8CF551377B2B1E35D1118EEAA1EED66D283B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4KB
SHA256 45f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037
MD5 214f98cb6a54654a4ca5c456f16aed0a
SHA1 2229090d2f6a1814ba648e5b5a5ae26389cba5a0
SHA512 5f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873
SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGM:Ljafl1gt6iUq/l0ZQjGM
TLSH
T1DB918EB6A5B89D076B4133F59D2B349F6CD4653B794592498810CCB904FFC0A81CAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
TLSH
T148F0DC1CD210E3DD40B3138E2888E6D892872B5D790BF5771554C0CDD027626126EB8B
MD5 SHA1 SHA512 TLSH

Submit Download

z.zip

Path C:\Users\Admin\AppData\Local\Temp\z.zip
Size 8KB
SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
MD5 63ee4412b95d7ad64c54b4ba673470a7
SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
TLSH
T11402AED2B15ED3C986DAA1BB449D46D221105A2B2F3DA914CF3D83C73C6D3A6744CA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download